TOP SECRET//SI//ORCON/NOFORN 



NATIONAL SECURITY AGENCY 
CENTRAL SECURITY SERVICE 



(U//FOUO) STELLARWIND Classification Guide 

(2-400) 



Effective Date: 21 January 2 0 09 




Kefth B. Alexander, 
Lieutenant General, USA 
Director, NSA 



Reason(s) for Classification: 

E.0. 12598, 1.4(c) 

Declassify on: 25 Years* 



Endorsed by: 




Associate Director, CIPR 



TOP SECRET//SI//ORCON/NOFORN 




TOP SECRET//SI//ORCON/NOFORN 



(U//FOUO) STELLARWIND Classification Guide 

(U) National Security Agency/Central Security Service (NSA/CSS): Classification Guide Number: 2-400 
(U//FOUO) Project/Activity Name: STELLARWIND (STLW) 

(U) Office of Origin: NSA/CSS Signals Intelligence Directorate (SID) 

(U//FOUO) POC: William J. Amass, CT Special Projects 
(U) Phone: 963-0087/963-0491 (s) 

(U//FOUO) Classified By: Keith B. Alexander, Lieutenant General, United States Army, Director, National Security Agency. 

(U) Declassify On: 25 Years* 

(U//FOUO) Note: This guide provides classification guidance for information requiring marking and handling under the STELLARWIND special 
compartment. 



(TS//SI//NF) In Januaiy 2008, the Director of National Intelligence authorized certain information associated with STELLARWIND, as well as 
related information authorized under Foreign Intelligence Surveillance Court (FISC) orders (such as the Large Content Foreign Intelligence 
Surveillance Act (FISA) orders, Business Records (BR) FISA orders and the Pen Register Trap and Trace (PR/TT) FISA orders), to be removed from 
the STELLARWIND compartment. This guide addresses information associated with STELLARWIND and associated classification instructions, 
while classification guidance associated with FISA information can be found, in one location, in an NSA/CSS FISA/Protect America Act 
(PAA)/FISA Amendments Act (FAA) classification guide authored by NSA SID Oversight and Compliance (SV). Consequently, this document will 
reference an NSA/CSS FISA/P AA/FAA classification guidance where information formerly associated with STELLARWIND is now authorized by 
the FISC. Also, this document references classification guidelines for FISA/P AA/FAA information and within Exceptionally Controlled Information 
(ECI) compartments within NSA where necessary. Users should reference both guides to determine proper classification. Additional Annexes are 
provided as additional information to assist the users of this guide. 

(TS//SI//NF) The markings “TSP” and “Compartmented” were at times used in briefing materials and documentation associated with the 
STELLARWIND program. “TSP” and “Compartmented” were used primarily by the National Security Agency (NSA) Legislative Affairs Office 
(LAO), NSA Office of General Counsel (OGC), and the Executive Branch in briefings and declarations intended for external audiences, such as 
Congress and the courts. The term “TSP” was initially used in relation to only that portion of the Program that was publicly disclosed by the 
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President in December 2005. These markings should be considered the same as the STELLAR WIND marking, but should not be directly 
associated with the program. The identifier “STARBURST” was also used in the earliest days of the program and should also be considered the 
same as “STELLARWIND.” 



Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


1 . (U) The fact that NS A had Presidential 
authority to intercept the international 
communications of people with known links 
to al Qaida and related terrorist 
organizations. 


UNCLASSIFIED 


N/A ^ ^ 


N/A 


(U) “I authorized the National 
Security Agency, consistent 
with U.S. law and the 
Constitution, to intercept the 
international communications 
of people with known links to 
Al Qaida and related terrorist 
organizations.” 

(U) Presidential public 
statement on 17 December 
2005 from the Roosevelt Room 
in the White House. 


2. (U) The fact that activities conducted 
under Presidential authorization have helped 
detect and prevent possible terrorist attacks 
in the United States and abroad. 


UNCLASSIFIED 


N/A 


N/A 


(U) “And the activities 
conducted under this 
authorization have helped 
detect and prevent possible 
terrorist attacks in the United 
States and abroad.” 

(U) Presidential public 
statement on 17 December 
2005 from the Roosevelt Room 
in the White House. 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


3. (U) The fact that activities authorized 
under Presidential authority were reviewed 
approximately every 45 days. 


UNCLASSIFIED 


N/A 


N/A 


(U) “The activities I authorized 
are reviewed approximately 
every 45 days.” 

(U) Presidential public 
statement on 17 December 
2005 from the Roosevelt Room 
in the White House. 


4. (U) The fact that the Program authorized 
by the President was reauthorized more than 
30 times. 


UNCLASSIFIED 


N/A 


N/A 


(U) “I have reauthorized this 
program more than 30 times 
since the September the 1 1 th 
attacks...” 

(U) Presidential public 
statement on 17 December 
2005 from the Roosevelt Room 
in the White House. 


5. (U) The fact that Leaders in Congress 
were briefed more than a dozen times on the 
Presidential authorizations and the activities 
conducted under them. 


UNCLASSIFIED 


N/A 


N/A 


(U) “Leaders in Congress have 
been briefed more than a dozen 
times on this authorization and 
the activities conducted under 
it.” 

(U) Presidential public 
statement on 17 December 
2005 from the Roosevelt Room 
in the White House. 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


6. (U) The names of members of Congress 
who received Terrorist Surveillance Program 
(TSP) briefings and dates of those briefings. 


UNCLASSIFIED 


N/A 


N/A 


(U) Only Congressional 
members’ names (with dates of 
respective briefings) were 
released. 

(U) Unclassified list of 
Congressional names and 
briefing dates released by 
ODNI in May 06. Contact 
NSA OGC or LAO for the list. 


7. (U) The fact that the Presidential 
authorization permitted NSA to intercept 
contents of communications where one party 
to the communication was outside the United 
States. 


UNCLASSIFIED 


N/A 


N/A 


(U) “The President has 
authorized a program to engage 
in electronic surveillance of a 
particular kind, and this would 
be the intercepts of contents of 
communications where one of 
the - one party to the 
communication is outside the 
United States.” 

(U) Attorney General Alberto 
Gonzales public statement at 
the News Conference on 19 
December 2005 regarding NSA 
surveillance with White House 
Press Secretary McClellan. 


8. (U) The term “STELLARWIND” with 
no further context. 


UNCLASSIFIED 


N/A 


N/A 


(U//FOUO) The term 
“STELLARWIND” or the 
abbreviation “STLW” when 
standing alone is 
UNCLASSIFIED. 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


9. (U) Official Executive Branch statements 
specifically associating TSP, the collection of 
phone communications, and NS A 
involvement with no amplifying details. 


UNCLASSIFIED 


N/A 


N/A 


(U) “As this description 
demonstrates, the terrorist 
surveillance program described 
by the President is very 
narrow. Because it is focused 
on international calls of 
individuals linked to al Qaeda 

(U) Public statement by 
Attorney General Gonzales at 
Ask the White House forum 25 
January 2006. 

(U) “The particular aspect of 
these activities that the 
President publicly described 
was limited to the targeting for 
interception without a court 
order of international 
communications of al Qaeda 
and affiliated terrorist 
organizations coming into or 
going out of the United States.” 

(U) Unclassified letter from the 
Director of National 
Intelligence J.M. McConnell to 
Senator Arlen Specter on 3 1 
July 2007. 


10. (S//NF) The fact that STELLARWIND, 
with no further context, is an anti-terrorism 
program. 


SECRET//NOFORN 


Executive Order 12958, as 
amended, Paragraph 1 .4(c) 
(hereafter 1.4(c)) 


25 Years* 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


1 1 . (S//NF) The fact that the Presidentially- 
authorized TSP at NSA was a component of 
STELLARWIND. 


SECRET//NOFORN 


1.4(c) 


25 Years* 




1 2. (U//FOUO) The association of the terms 
STELLARWIND and NSA - no further 
details. 


UNCLASIFIED// 

FOUO 


Freedom of Information Act 
Exemption 3 (hereafter 
Exemption 3) 


N/A 




13. (S//NF) The terms and markings “TSP” 
or “COMPARTMENTED” or STARBURST 
when associated with the STELLARWIND 
cover term and NSA. 


SECRET//NOFORN 


1.4(c) 


25 Years* 


(S//NF) This classification 
determination classifies the fact 
that “TSP”, STARBURST and 
“COMPARTMENTED” 
markings were used to identify 
the STELLARWIND program. 


14. (TS//SI//NF) Association of the 
STELLARWIND Program (with no 
additional details) with: 

a. Activity under the Large Content FISA 
(LCF) and/or; 

b. activity under the Protect America Act 
(PAA). 


TOP SECRET//SI// 
NOFORN 


1.4(c) 


25 Years* 


(TS//SI//NF) Clarifies that the 
sequence of transition events 
leading up to PAA enactment 
and its associated operational 
considerations do not require 
STLW compartmented 
protection for LCF and PAA 
data. 


15. (U//FOUO) The fact that a specific 
single individual of the Executive Branch is 
cleared for access to STELLARWIND with 
no amplifying details where such information 
has not been publicly released by the 
Executive Branch. 


UNCLASSIFIED// 

FOUO 


Exemption 3 


N/A 


(U//FOUO) Information that a 
specific individual in the 
Executive Branch is cleared for 
STLW with no amplifying 
details may be protected from 
disclosure under FOIA. 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


16. (U//FOUO) The full list of all individuals 
cleared for STELLARWIND or who had 
access to STELLARWIND data. 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(S//NF) The full list of Ml 
individuals cleared for 
STELLARWIND or who had 
access to STELLARWIND 
data is classified TOP 
SECRET//STLW/SI// 
ORCON/NOFORN due to 
identifiable relationships 
between individuals and with 
other agencies, to include 
name, organization, and 
position. Classified due to 
revealing the totality of the 
STLW program. 


17. (U//FOUO) The entire listing of NSA 
personnel cleared for STELLARWIND 




1.4(c) 


25 Years* 


— 


a. (U//FOUO) with no 

amplifying details (such as 
detailed organization, 
mission, role, etc.). 


a. TOP SECRET// 
NOFORN 








b. (U//FOUO) with amplifying 
details. 


b. TOP SECRET//SI// 
NOFORN 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


18. (U) Identity of Department of Justice 
(DOJ) attorneys who publicly represent or 
have represented NS A or have been publicly 
identified as cleared for “TSP.” 


UNCLASSIFIED 
(U) See Remarks 


Exemption 3 


N/A 


(U//FOUO) Comments: 
Consult NSA OGC for a list of 
those specific DOJ attorneys 
whose association with the 
TSP program is 
UNCLASSIFIED. 

(S//NF) This determination 
addresses the fact that in many 
cases the phrase “cleared for 
TSP”, with no amplifying 
details, was used to identify 
DOJ attorneys working STLW 
program matters. 


19. (U//FOUO) Names of Executive (not 
including NSA), Legislative, or Judicial 
Branch personnel cleared for STLW who 
have not been publicly identified by the 
Executive Branch. 


TOP SECRET//STLW// 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) The names of 
specific individuals in the 
Government who have not 
been publicly identified by the 
Executive Branch as cleared 
for STLW remains classified as 
STLW because of identifiable 
relationships between 
individuals and with other 
agencies, to include name, 
organization, and position. 


: : • ■ , * ! 

1 ’ ■ ' " ■ ~ ' a, ; 


>j 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


20. (TS//SI//NF) STLW counterterrorism 
information used to evaluate the quantity or 
value of STELLARWIND collection based 
on products/tippers/leads provided without 
reference to targets, methods or techniques. 


TOP SECRET//SI// 
ORCON/NOFORN 


1.4(c) 


25 Years* 


(TS//SI//OC/NF) Specifically 
addresses the number of 
reports, tippers, or leads 
generated under STLW. Any 
information revealing or 
naming Special Source 
Operations (SSO) programs 
supporting STELLARWIND 
must also include additional 
markings/Exceptional 
Controlled Information (ECI)s 
for the program(s) as specified 
by SSO. 


21 . (TS//SI//NF) Information that reveals the 
scope of STELLARWIND collection against 
various methods of communication, 
including voice, data networks, facsimile, 
etc. without details of the special 
authorization 


TOP SECRET//SI// 
ORCON/NOFORN 


1.4(c) 


25 Years* 


(TS//SI//NF) This classification 
determination allows 
information concerning the fact 
of various methods of 
collection under STLW, and 
subsequently authorized under 
FISA (1 7 Jan 2007) or PAA (5 
Aug 2007), to be handled 
outside of STLW 
compartmented channels - 
Example: Data Flow X is 
Digital Network Intelligence 
(DNI) collection under the 
STLW program - no further 
details. 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


22. (TS//SI//NF) Information that reveals the 
breadth and success of STELLAR WIND 
collection against specific terrorism-related 
entities such as the number of tippers 
published, number of published product 
reports, and numbers of Requests for 
Information answered without detailing 
target selectors, without details of the special 
authorization 


TOP SECRET//SI// 
ORCON/NOFORN 


1.4(c) 


25 Years* 


Example: (TS//SI//OC/NF) 
The number of Requests For 
Information (RFIs) generated 
under the STELLARWIND 
program was 15,000. 


23. (TS//SI//NF) Information that reveals 
details of the operational relationship 
between the STELLARWIND program, the 
FISA Large Content, FISA BR, and FISA 
PR/TT Orders, the PAA collections, and the 
FAA collections. 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(C//SI//REL TO USA, FVEY) 
Note: SSO may require that 
this information be marked 
with additional caveats (ECI 
WPG for WHIPGENIE). 
Please see the ECI WPG 
classification guide. 

(TS//SI//NF) Information 
comparing ongoing 
FISA/P AA/FAA operations to 
the specifics of the 
Presidentially- Authorized 
Program will remain 
compartmented as STLW. 


24. (TS//SI//NF) STLW counterterrorism 
listings or reports detailing the totality of 
specific techniques and selectors targeted 
under the STELLARWIND program 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(TS//SI//NF) Dictates that all 
program reports & briefings 
containing detailed 
STELLARWIND target lists or 
specific techniques, with 
association to the special 
authorization continue to be 
marked TOP SECRET//STLW/ 
SI//ORCON/NOFORN 

(U) See also Portal section. 
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Description of Information 


Classification 


Reason 


Declassification 


Remarks 




/Markings 




Date 




25. (S//NF) Information that reveals the 


TOP SECRET//STLW/ 


1.4(c) 


25 Years* 


(S//NF) Information that 


scope of operations under the Presidential 


SI//ORCON/NOFORN 






summarizes or otherwise 


authorization. (Such as collection 








specifies the scope of 


techniques, targets, or other operational 








operations authorized by the 


details) 








President, but not publicly 
disclosed, remains 
compartmented. Example: 
Program Briefings, Program 
Memos, NSA LAO & NSA 
OGC summaries, etc. 


«■ ■ ! ! 3 : i r -t. ^ :::X; V xr ' 







■ ^ 


26. (U//FOUO) The fact of FBI collaboration 








(S//NF) Operational details 


on the STELLARWIND program 








about collaboration between 
NSA and FBI and FBI’s 


a. (U//FOUO) The association 


a. UNCLASSIFIED// 


Exemption 3 


N/A 


involvement in the STLW 


of the terms 


FOUO 






program (such as specific 


STELLARWIND and FBI 








targets, specific sources, 
methods, etc.) will raise the 


b. (U//FOUO) The fact that 


b. UNCLASSIFIED// 


Exemption 3 


N/A 


classification to 


NSA provided the FBI 


FOUO 






TOP SECRET//STLW/SI// 


information collected under 
the Presidentially Authorized 
program. 








ORCON/NOFORN 


c. (S//NF) The fact that FBI 


c. SECRET//NOFORN 


1.4(c) 


25 Years* 




played an operational role in 
the program and details 
describing that role. 
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Description of Information 


Classification 


Reason 


Declassification 


Remarks 




/Markings 




Date 




27. (U//FOUO) The fact of CIA 








(S//NF) Operational details 


collaboration on the STELLAR WIND 








about collaboration between 


program 


a. UNCLASSIFIED// 


Exemption 3 


N/A 


NSA and CIA and CIA’s 
involvement in the STLW 


a. (U//FOUO) The association 


FOUO 






program (such as specific 


of the terms 








targets, specific sources, 


STELLAR WIND and CIA 


b. UNCLASSIFIED// 


Exemption 3 


N/A 


methods, etc.) will raise the 
classification to 


b. (U//FOUO) The fact that 


FOUO 






TOP SECRET//STLW/SI// 


NSA provided the CIA 
information collected under 
the Presidentially Authorized 
program. 


c. SECRET//NOFORN 


1.4(c) 


25 Years* 


ORCON/NOFORN 


c. (S//NF) The fact that CIA 










played an operational role in 
the program and details 
describing that role. 
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Description of Information 


Classification 


Reason 


Declassification 


Remarks 




/Markings 




Date 




28. (U) Information about communications 








(U) “... electronic 


providers. 








communication service 
providers play an important 


a. (U) The fact that 


UNCLASSIFIED 


N/A 


N/A 


role in assisting intelligence 


communications service 








officials in national security 


providers provide assistance 








activities. Indeed, the 


in national security activities 








intelligence community cannot 
obtain the intelligence it needs 
without assistance from these 


b. (TS//SI//NF) Information 


TOP SECRET//STLW/ 


1.4(c) 


25 Years* 


companies.” 


revealing the cooperative 
relationships with, and 


SI//ORCON/NOFORN 






(U) From the 26 October 2007 


identities of, U.S. 








Senate Select Committee on 


telecommunications 








Intelligence report: “Foreign 


providers under the 








Intelligence Surveillance Act 


STELLARWIND 








of 1978 Amendments Act of 


authorities. 








2007.” 










(U) See also: Unclassified 
testimony of Kenneth L. 
Wainstein, Assistant Attorney 
General, National Security 
Division, before Senate 
Committee on the Judiciary on 
3 1 October 2007. 










(U) Details may require 
additional protection within an 
ECI. 


r, ; * ; , r . , , . 


himi j 








29. (U//FOUO) Aggregate program funding 


TOP SECRET//SI// 


1.4(c) 


25 Years* 




information associated only with the 
STELLARWIND cover term. 


NOFORN 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


30. (U//FOUO) Detailed programmatic 
information that reveals the overall cost of 
the STELLARWIND program in context 
with operational details. 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) Information that 
would provide an 
understanding of the total 
overall budget for the STLW 
program remains 
compartmented and is not 
releasable to contractors. 


3 1 . (U//FOUO) Budget submissions or 
information that reveals the detailed 
technical characteristics of any individual 
items funded by the STELLARWIND 
program including size, capabilities, and 
functions. 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) Information that 
would provide an 
understanding of the total 
overall budget for the STLW 
program remains 
compartmented and is not 
releasable to contractors. 


■ |J 81 I11S1 111 | 






||§l 


' r y\ ' '' 




32. (TS//SI//NF) Specific details identifying 
collection capabilities or capacities without 
revealing the methods of STELLARWIND 
counterterrorism target communications. 


SECRET//SI// 

REL TO USA, FVEY 

At a minimum 


1.4(c) 


25 Years* 


(C//SI//REL TO USA, FVEY) 
May be TOP SECRET or 
NOFORN if source details are 
provided. Special compartment 
marking based on SSO 
guidance (ECI WPG) required 
if source details are included. 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


33. (TS//SI//NF) Information that reveals in 
any way the location of facilities that 
provided access and/or collection whether in 
summary or detailed terms and is associated 
with STELLARWIND. 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(C//SI//REL TO USA, FVEY) 
Information that would provide 
an understanding of the 
partnership/location for the 
program is covered by the ECI 
WPG SSO compartment. 

(C//SI//REL TO USA, FVEY) 
This information is also 
protected by the SSO 
compartment (ECI WPG). 


34. (TS//SI//NF) Dataflows or associated 
data created to support collection derived 
from STELLARWIND program without 
revealing the details of the Presidential 
authorization. 


TOP SECRET//SI// 
NOFORN 


1.4(c) 


25 Years* 


(TS//SI//NF) Clarifies that the 
sequence of transition events 
leading up to PAA enactment 
and its associated operational 
considerations do not require 
STLW compartmented 
protection for LCF and PAA 
data. 


35. (U//FOUO) Specific performance 
parameters for search analysis detection or 
selection. 


TOP SECRET//SI// 
NOFORN 


1.4(c) 


25 Years* 


(TS//SI/NF) For example, 
response times, capacities, and 
loading would reveal 
operational details of program. 


36. (S//NF) Descriptions, diagrams, 
schematics, or other technical documentation 
that identifies specific SIGINT methods, 
techniques and devices used to select, filter 
and process STELLARWIND target 
communications without specific reference to 
the authorization and details concerning the 
creation of the STELLARWIND program. 


TOP SECRET//SI// 
ORCON/NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) Information may 
be otherwise controlled/ 
compartmented by SSO. 
Amplifying details may be 
protected within an ECI. 


(U) METADATA - OPERATIONS 


| 
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TOP SECRET//SI//ORCON/NOFORN 



Description of information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


37. (TS//SI//NF) Metadata analysis and 
target development, techniques, and results 
conducted under the STELLAR WIND 
program, with no details about the special 
authorization or the access points from which 
we have gathered the data. 


TOP SECRET//SI// 
ORCON/NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) Information 
currently marked as STLW 
(such as reports, database 
records, etc.) remains 
compartmented until 
appropriate action is taken 
under Executive Order 12958, 
as amended. Program specifics 
concerning output and analytic 
results may be downgraded to 
TOP SECRET//SI//ORCON/ 
NOFORN, but information 
may not be removed from the 
STLW compartment without 
approval from an appropriate 
Original Classification 
Authority and in coordination 
with the appropriate SIGINT 
authority (STLW Program 
Manager (PM) or D/PM, S12 
Information Sharing Services, 
and NSA OGC). TheNSA 
OGC can be used as an initial 
POC/contact point. 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


38. (TS//SI//NF) Information revealing the 
fact that a specific terrorism-related group 
had been targeted using the 
STELLARWIND authorities - no details 
about the special authorization. 


TOP SECRET //SI// 
ORCON/NOFORN 


1.4(c) 


25 Years* 


(S//NF) Specific individual 
STELLARWIND Terrorism 
targets will be classified TOP 
SECRET//STLW/SI//OC/NF. 
However, large entities such as 
a terrorist group do not require 
compartmentation. The STLW 
Program Manager Office 
(PMO) documents, such as 
PMO memos, revealing groups 
targeted and effective dates 
remain STLW-compartmented. 


(TS//SI//NF) METADATA (DIGITAL NETWORK INTELLIGENCE (DNI)) and DIALED NUMBER RECOGNITION (DNR» INFORMATION 

: ; ^ ■ '• ' . ' • • - ' ' - . : ' ^ - - - - ' /V --V. ' 


39. (TS//SI//NF) Digital Network 
Intelligence (DNI) metadata acquired under 
Presidential authorization (pre-17 July 2004 
metadata) 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(TS//SI//NF) The pre-17 July 
2004 metadata repository is 
embargoed and remains in the 
STLW compartment. Access 
to it requires coordination with 
NS A OGC as it may implicate 
certain FISA court orders. 

(U//FOUO) This data is not on- 
line and is sequestered. 

(U) See Annex A for additional 
details. 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


40. (TS//SI//NF) Dialed Number 
Recognition metadata acquired under 
Presidential authorization (pre 24 May 2006 
metadata archive) 


TOP SECRET//SI// 
NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) Information 
currently marked as STLW 
(such as reports, database 
records, etc.) remains 
compartmented until 
appropriate action is taken 
under Executive Order 12958, 
as amended. Program specifics 
concerning output and analytic 
results may be downgraded to 
TOP SECRET//SI//ORCON/ 
NOFORN, but information 
may not be removed from the 
STLW compartment without 
approval from an appropriate 
Original Classification 
Authority and in coordination 
with the appropriate SIGINT 
authority (STLW Program 
Manager (PM) or D/PM, S12 
Information Sharing Services, 
and NSA OGC). TheNSA 
OGC can be used as an initial 
POC/contact point. 

(TS//SI//NF) Access to the pre- 
May 2006 metadata archive is 
at the TS//SI//OC/NF level. 
However, the data must be 
traceable by authorization (e.g., 
Presidential Directive). 

(U) See Annex A for additional 
details. 


(U) CONTENT: s l . . 




11! 


■ j 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


41 . (TS//SI//NF) Content Analysis using 
STELLARWIND derived information to 
develop lead information or to report on the 
activities of specific terrorism-related 
entities. 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) Target Office will 
add ORCON and NOFORN 
caveats to all intelligence 
products derived from 
STELLARWIND-authorized 
accesses. 

(U//FOUO) Information 
currently marked as STLW 
(such as reports, database 
records, etc.) remains 
compartmented until 
appropriate action is taken 
under Executive Order 12958, 
as amended. Program specifics 
concerning output and analytic 
results may be downgraded to 
TOP SECRET//SI//ORCON/ 
NOFORN, but information 
may not be removed from the 
STLW compartment without 
approval from an appropriate 
Original Classification 
Authority and in coordination 
with the appropriate SIGINT 
authority (STLW Program 
Manager (PM) or D/PM, SI 2 
Information Sharing Services, 
and NSA OGC). TheNSA 
OGC can be used as an initial 
POC/contact point. 

(TS//SI//NF) Access to data 
identified by STELLARWIND 
SIGINT Address (hereafter 
SIGAD US3170) will be 



TOP SECRET//SI//ORCON/NOFORN 



19 





TOP SECRET//SI//ORCON/NOFORN 



Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 










allowed on a case-by-case 
basis by the STLW Program 
Manager. Reporting derived 
from this collection must be 
clearly identified as to source. 


(U) OPERATIONS/COLLECTION 


42. (TS//SI//NF) The SIGINT address 
(SIGAD) US3170 when associated with the 
STELLARWIND program and content 
collection. 


TOP SECRET//SI// 
NOFORN 


1.4(c) 


25 Years* 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


43. (TS//SI//NF) Unevaluated, unminimized 
content intercept alone, identified with 
SIGAD US3 170, without knowledge of 
access techniques. 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) Information 
currently marked as STLW 
(such as reports, database 
records, etc.) remains 
compartmented until 
appropriate action is taken 
under Executive Order 12958, 
as amended. Program specifics 
concerning output and analytic 
results may be downgraded to 
TOP SECRET//SI//ORCON/ 
NOFORN, but information 
may not be removed from the 
STLW compartment without 
approval from an appropriate 
Original Classification 
Authority and in coordination 
with the appropriate SIGINT 
authority (STLW Program 
Manager (PM) or D/PM, S12 
Information Sharing Services, 
and NSA OGC). TheNSA 
OGC can be used as an initial 
POC/contact point. 

(TS//SI//NF) Access to data 
identified by SIGAD US3170 
will be allowed on a case-by- 
case basis by the STLW 
Program Manager. Reporting 
derived from this collection 
must be clearly identified as to 
source. 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


44. (TS//SI//NF) Processed traffic labeled 
with SIGAD US3170 (such as verbatim 
transcripts, transcription notes or other 
related information) that does not disclose 
specific methods or techniques as associated 
with STELLARWIND authorizations. 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(U) See Remark for 43. 


45. (TS//SI//NF) Program traffic, acquired 
from accesses but never disseminated and not 
associated with SIGAD 3170, such as 
unevaluated, unminimized, verbatim 
transcript or gisted traffic that does not 
disclose specific methods or techniques as 
associated with authorizations 


TOP SECRET//SI// 
NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) Access to program 
material such as this should be 
coordinated with NSA OGC 
and the appropriate SIGINT 
authority. The NSA OGC can 
be used as an initial 
POC/contact point. 


46. (U//FOUO) Association of specific 
tasking to a specific STELLARWIND data 
source. 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) Information 
currently marked as STLW 
remains compartmented until 
appropriate action is taken 
under Executive Order 12958, 
as amended. Information may 
not be removed from the 
STLW compartment without 
approval from an appropriate 
Original Classification 
Authority and in coordination 
with the appropriate SIGINT 
authority (STLW Program 
Manager (PM) or D/PM, S12 
Information Sharing Services, 
and NSA OGC). The NSA 
OGC can be used as an initial 
POC/contact point. 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


47. (TS//SI//NF) Information that reveals the 
specific telephone number or email address 
of a targeted terrorism-related entity or 
individual tasked with STELLARWIND 
authorities. 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) Information 
currently marked as STLW 
remains compartmented until 
appropriate action is taken 
under Executive Order 12958, 
as amended. Information may 
not be removed from the 
STLW compartment without 
approval from an appropriate 
Original Classification 
Authority and in coordination 
with the appropriate SIGINT 
authority (STLW Program 
Manager (PM) or D/PM, S12 
Information Sharing Services, 
and NSA OGC). TheNSA 
OGC can be used as an initial 
POC/contact point. 


48. (U//FOUO) Analyst Holdings (hardcopy 
and softcopy)- Documentation marked as 
STELLARWIND. 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) The records review 
and administrative debriefing 
process will be used to help 
inform analysts on what steps 
to take concerning their 
personal records. 

(U//FOUO) Continue to protect 
as STLW. See Annex B. 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


49. (U//FOUO) Any document related to 
STLW Program Management decisions 
(Program Memos, Due Diligence Notes, etc.) 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) These documents 
will be available from the 
portal only to STLW PMO 
personnel or to other STLW 
authorized and cleared 
individuals. 


50. (TS//SI//NF) Documentation concerning 
FISA PR/TT and FISA BR court orders 
such as: 

• Declarations 

• Applications 

• Court Orders (Primary and Secondary) 

• Reports or updates 

• Associated motions 


TOP SECRET//SI// 
NOFORN 


1.4(c) 


25 Years* 


(TS//SI//NF) Remove from the 
STLW compartment - see the 
appropriate NSA/CSS 
FISA/P AA/FAA and ECI 
WPG classification guide. 

(TS//SI//NF) Court Orders, 
required reporting, 
Applications, Declarations, and 
associated motions contain 
NS A ECI information, but are 
not marked as such because of 
guidelines on how court 
documents are marked and 
handled. Therefore, they 
require additional controls and 
protection and must be handled 
internally as ECI. 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


53. (TS//SI//NF) STLW counterterrorism 
information contained in the Requests For 
Information (RFI) segment of the Numbers 
database, currently marked STLW. 


TOP SECRET// 

STLW/SI//ORCON/ 

NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) Restrict access to 
the legacy RFI information on 
the portal to all but a cadre of 
cleared SIGINT Intelligence 
Directorate Counterterrorism 
personnel. RFIs will be used to 
identify information needed to 
be reviewed and subsequently 
removed from the STLW 
compartment. 

(U//FOUO) Information 
currently marked as STLW 
remains compartmented until 
appropriate action is taken 
under Executive Order 12958, 
as amended. Information may 
not be removed from the 
STLW compartment without 
approval from an appropriate 
Original Classification 
Authority and in coordination 
with the appropriate SIGINT 
authority (STLW Program 
Manager (PM) or D/PM, SI 2 
Information Sharing Services, 
and NSA OGC). TheNSA 
OGC can be used as an initial 
POC/contact point. 




■ 


54. (TS//SI//NF) Digital Network 
Intelligence (DNI) Metadata Reports - 
Includes all metadata reporting derived from 
special authorization or FISA court 
authorization and currently marked 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(TS//SI//NF) Although the 
Director of National 
Intelligence decision (see 
introduction section of this 
guide) allowed NSA to remove 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


STELLARWIND. 








certain data from the STLW 
compartment, not all legacy 
data (to include reporting) was 
automatically removed from 
the STLW compartment. 
Consequently there is reporting 
in the STLW databases that is 
eligible to be removed from the 
compartment, but was not. The 
data still carries a STLW 
marking and must be protected 
as such until it is formally 
removed from the 
compartment. Consequently, it 
is necessary to restrict access to 
existing reports to all but a 
cadre of cleared SIGINT 
Intelligence Directorate 
Counterterrorism personnel. 
Additional RFI can be used to 
identify information needed to 
be reviewed and subsequently 
removed from the STLW 
compartment. Distribution may 
be expanded. If reporting is 
removed from the STLW 
compartment and reissued, 
procedures must be in place so 
that the source of the 
information can be readily 
determined. 

(U//FOUO) Information 
currently marked as STLW 
remains compartmented until 
appropriate action is taken 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 










under Executive Order 12958, 
as amended. Information may 
not be removed from the 
STLW compartment without 
approval from an appropriate 
Original Classification 
Authority and in coordination 
with the appropriate SIGINT 
authority (STLW Program 
Manager (PM) or D/PM, S12 
Information Sharing Services, 
and NSA OGC). TheNSA 
OGC can be used as an initial 
POC/contact point. 

(U//FOUO) Maintain 
STELLARWIND controls on 
existing reports. Remove from 
the STLW compartment and 
release in new format if 
required. Individual reports 
may be reclassified to TOP 
SECRET//SI// 

ORCON/NOFORN, but must 
be cancelled and reissued, in 
the new format, at the new 
classification, after 
decompartmentation. Tearlines 
cannot be re-distributed 
without reissuing the original 
report. 


55. (TS//SI//NF) Dialed Number 
Recognition (DNR) Metadata Reports 
Includes all metadata reporting derived from 
special authorization or FISA court 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(TS//SI//NF) Although the 
Director of National 
Intelligence decision (see 
introduction section of this 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


authorization and currently marked 
STELLARWIND 








guide) allowed NSA to remove 
certain data from the STLW 
compartment, not all legacy 
data (to include reporting) was 
automatically removed from 
the STLW compartment. 
Consequently there is reporting 
in the STLW databases that is 
eligible to be removed from the 
compartment, but was not. The 
data still carries a STLW 
marking and must be protected 
as such until it is formally 
removed from the 
compartment. Consequently, it 
is necessary to restrict access to 
existing reports to all but a 
cadre of cleared SIGINT 
Intelligence Directorate 
Counterterrorism personnel. 
Additional RFI can be used to 
identify information needed to 
be reviewed and subsequently 
removed from the STLW 
compartment. Distribution may 
be expanded. If reporting is 
removed from the STLW 
compartment and reissued, 
procedures must be in place so 
that the source of the 
information can be readily 
determined. 

(U//FOUO) Information 
currently marked as STLW 
remains compartmented until 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 










appropriate action is taken 
under Executive Order 12958, 
as amended. Information may 
not be removed from the 
STLW compartment without 
approval from an appropriate 
Original Classification 
Authority and in coordination 
with the appropriate SIGINT 
authority (STLW Program 
Manager (PM) or D/PM, S12 
Information Sharing Services, 
and NSA OGC). TheNSA 
OGC can be used as an initial 
POC/contact point 

(U//FOUO) Maintain 
STELLARWIND controls on 
existing reports. Remove from 
the STLW compartment and 
release in new format if 
required. Individual reports 
may be reclassified to TOP 
SECRET//SI// 

ORCON/NOFORN, but must 
be cancelled and reissued, in 
the new format, at the new 
classification, after 
decompartmentation. Tearlines 
cannot be re-distributed 
without reissuing the original 
report. 


56. (TS//SI//NF) NSA/CSS disseminated 
serialized STLW product derived from 
STELLARWIND and currently marked 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(TS//SI//NF) Although the 
Director of National 
Intelligence decision (see 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


STELLARWIND 








introduction section of this 
guide) allowed NSA to remove 
certain data from the STLW 
compartment, not all legacy 
data (to include reporting) was 
automatically removed from 
the STLW compartment. 
Consequently there is reporting 
in the STLW databases that is 
eligible to be removed from the 
compartment, but was not. The 
data still carries a STLW 
marking and must be protected 
as such until it is formally 
removed from the 
compartment. Consequently, it 
is necessary to restrict access to 
existing reports to all but a 
cadre of cleared SIGINT 
Intelligence Directorate 
Counterterrorism personnel. 
Additional RFI can be used to 
identify information needed to 
be reviewed and subsequently 
removed from the STLW 
compartment. Distribution may 
be expanded. If reporting is 
removed from the STLW 
compartment and reissued, 
procedures must be in place so 
that the source of the 
information can be readily 
determined. 

(U//FOUO) Information 
currently marked as STLW 
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Classification 

/Markings 



Reason 



Declassification 

Date 



Remarks 



remains compartmented until 
appropriate action is taken 
under Executive Order 12958, 
as amended. Information may 
not be removed from the 
STLW compartment without 
approval from an appropriate 
Original Classification 
Authority and in coordination 
with the appropriate SIGINT 
authority (STLW Program 
Manager (PM) or D/PM, S12 
Information Sharing Services, 
and NS A OGC). TheNSA 
OGC can be used as an initial 
POC/contact point. 

(U//FOUO) Maintain 
STELLARWIND controls on 
existing reports. Remove from 
the STLW compartment and 
release in new format if 
required. Individual reports 
may be reclassified to TOP 
SECRET//SI// 

ORCON/NOFORN, but must 
be cancelled and reissued, in 
the new format, at the new 
classification, after 
decompartmentation. Tearlines 
cannot be re-distributed 
without reissuing the original 
report. 
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Classification 

/Markings 
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Declassification 

Date 


Remarks 


57. (TS//SI//NF) STLW PMO 
counterterrorism documentation such as 
Program Memorandum or other Program 
Management Office documentation currently 
marked STELLARWIND. 


TOP SECRJET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) Remains protected 
under the STLW compartment. 
Information currently marked 
as STLW remains 
compartmented until 
appropriate action is taken 
under Executive Order 12958, 
as amended. Information may 
not be removed from the 
STLW compartment without 
approval from an appropriate 
Original Classification 
Authority and in coordination 
with the appropriate SIGINT 
authority (STLW Program 
Manager (PM) or D/PM, SI 2 
Information Sharing Services, 
and NSA OGC). TheNSA 
OGC can be used as an initial 
POC/contact point. 
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Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


58. (U//FOUO) NSA OGC documentation 
currently marked STELLARWIND. 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) Remains protected 
under the STLW compartment. 
Information currently marked 
as STLW remains 
compartmented until 
appropriate action is taken 
under Executive Order 12958, 
as amended. Information may 
not be removed from the 
STLW compartment without 
approval from an appropriate 
Original Classification 
Authority and in coordination 
with the appropriate SIGINT 
authority (STLW Program 
Manager (PM) or D/PM, S12 
Information Sharing Services, 
and NSA OGC). The NSA 
OGC can be used as an initial 
POC/contact point. 
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Description of Information 


Classification 

/Markings 


Reason 


Declassification 

Date 


Remarks 


59. (U//FOUO) NSA IG documentation 
currently marked STELLAR WIND. 


TOP SECRET//STLW/ 
SI//ORCON/NOFORN 


1.4(c) 


25 Years* 


(U//FOUO) Remains protected 
under the STLW compartment. 
Information currently marked 
as STLW remains 
compartmented until 
appropriate action is taken 
under Executive Order 12958, 
as amended. Information may 
not be removed from the 
STLW compartment without 
approval from an appropriate 
Original Classification 
Authority and in coordination 
with the appropriate SIGINT 
authority (STLW Program 
Manager (PM) or D/PM, SI 2 
Information Sharing Services, 
and NSA OGC). The NSA 
OGC can be used as an initial 
POC/contact point. 



*25 years: Declassification in 25 years indicates that the information is classified for 25 years from the date a document is created or 25 years from the date of this 
original classification decision, whichever is later. 



(U) ANNEX A: 

(TS//SI//NF) FISA PR/TT and BR 



(TS//SI//NF) Information acquired under court authorization via FISA PR/TT or FISA BR, but currently marked STLW (e.g. FISA PR/TT or FISA BR 
information commingled in databases with other STLW information, or otherwise controlled as STLW due to overlapping authorizations), is eligible to be 
removed from the STLW compartment. However, information may not be removed from the STLW compartment without appropriate action by an original 
classification authority under Executive Order 12958, as amended, or coordination with the STLW Program Manager (PM) or D/PM, S12 Information Sharing 
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Services, and OGC. The NSA OGC can be used as an initial POC/contact point. Although compartmented controls may be removed from the FISA PR/TT and 
FISA BR information currently marked STLW, court ordered access controls and classification guidelines must continue to be observed. Users should note that 
classification guidance for FISA/P AA/FAA/FAA information can be found in an NSA/CSS FISA/P AA/FAA guide. 

(TS//SI//NF) For example, the FISA/P AA/FAA classification guide should be consulted when deriving classification for FISA PR/TT or FISA BR information 
currently marked STLW such as: 

(TS//SI//NF) FISA PR/TT (initiated 17 July 2004) 

1. (TS//SI//NF) FISA PR/TT information collected, stored, processed under FISA authorization. 

2. (TS//SI//NF) FISA PR/TT targeting information - email address forms, query requests and approvals, selectors queried, query results, alert lists. 

3. (TS//SI//NF) FISA PR/TT-related Mainway databases, realms & data flows and all related technical data, collection statistics, and software. 

4. (TS//SI//NF) FISA PR/TT-related working aids, briefing materials, query logs, etc. 

(TS//SI//NF) BR FISA (initiated 24 May 2006) 

1. (TS//SI//NF) FISA BR information collected, stored, processed under FISA authorization. 

2. (TS//SI//NF) FISA BR targeting information - address forms, query requests and approvals, selectors queried, query results, alert lists, etc. 

3. (TS//SI//NF) FISA BR-related Mainway Databases, realms & data flows and all related technical data, collection statistics, and software. 

4. (TS//SI//NF) FISA BR-related Working Aids, briefing materials, query logs, etc. 



(U) ANNEX B: 

(U) Preservation Requirements and Other Related Issues 

(U//FOUO) Documentation you have originated (memos, analytic summaries, etc.) - do not destroy/remove/delete. Please contact the SID PMO for questions. 
Your records may constitute valuable temporary or permanent records and may be transferred to a designated official or records officer, records include documents 
created regarding STLW policies, decisions, procedures and essential operational, logistical and support transactions. 

(U//FOUO) SIGINT Reporting -You are authorized to retain published reporting marked with the STLW caveat, however further dissemination of the 
information contained in those reports must be coordinated through the SIGINT Intelligence Directorate Counterterrorism RFI process and accurately sourced to 
the original STLW report number/title. 
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(TS//SI//REL TO USA, FVEY) Other STLW information - Record Retention Order - In addition to your obligations under Federal Records Act and NSA Policy, 
you are reminded that Judge Vaughn Walker, USDJ, issued a Preservation order on November 6, 2007 relating to litigation challenging the surveillance activities 
authorized by the President after the attacks of September 1 1, 2001. You should preserve and retain any (hardcopy or electronic - including email) information, 
documents or data that may be relevant to that litigation. If you have any questions about this obligation, you should contact your Office of General Counsel. 

(S//NF) NSA-generated materials submitted to a court in support of ongoing litigation which contains facts that reveal scope and scale of the Presidentially 
Authorized Program should be handled as STLW. Note: Many litigation documents were marked as TSP instead of STLW. These documents, and supporting 
facts, relate directly to the special authorization and remain STLW-compartmented. 
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